Workflow Security Hardening

.github/workflows/SAPUI5_Version_Monitoring.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   update-version:
     name: Check and Update SAPUI5 Version
+    environment: dev
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/blackduck.yml

@@ -16,6 +16,7 @@ permissions:
 
 jobs:
   build:
+    environment: dev
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -40,11 +41,15 @@ jobs:
         run: curl --silent -O https://detect.blackduck.com/detect9.sh
 
       - name: Run & analyze BlackDuck Scan
+        env:
+          BLACKDUCK_TOKEN: ${{ secrets.BLACKDUCK_TOKEN }}
         run: |
+          set +x
+          echo "::add-mask::$BLACKDUCK_TOKEN"
           bash ./detect9.sh -d \
           --logging.level.com.synopsys.integration=DEBUG  \
           --blackduck.url="https://sap.blackducksoftware.com" \
-          --blackduck.api.token=""${{ secrets.BLACKDUCK_TOKEN }}""   \
+          --blackduck.api.token="$BLACKDUCK_TOKEN"   \
           --detect.blackduck.signature.scanner.arguments="--min-scan-interval=0" \
           --detect.maven.build.command="install -P unit-tests  -DskipIntegrationTests" \
           --detect.latest.release.version="9.6.0" \

.github/workflows/cfdeploy.yml

@@ -32,6 +32,7 @@ permissions:
 
 jobs:
   Deploy:
+    environment: dev
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.workflow_choice == 'Deploy' }}
 
@@ -72,6 +73,11 @@ jobs:
 
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
+          set +x
+          echo "::add-mask::$CF_API"
+          echo "::add-mask::$CF_USER"
+          echo "::add-mask::$CF_PASSWORD"
+          echo "::add-mask::$CF_ORG"
           echo "🔄 Preparing to deploy..."
           echo "Current Branch: 📂"
           git branch
@@ -108,14 +114,20 @@ jobs:
           cf install-plugin multiapps -f
 
           echo "🔑 Logging into Cloud Foundry..."
-          cf login -a ${{ secrets.CF_API }} -u ${{ secrets.CF_USER }} -p ${{ secrets.CF_PASSWORD }} -o ${{ secrets.CF_ORG }} -s ${{ github.event.inputs.cf_space }}
+          cf login -a "$CF_API" -u "$CF_USER" -p "$CF_PASSWORD" -o "$CF_ORG" -s ${{ github.event.inputs.cf_space }} > /dev/null
           echo "✅ Logged in successfully!"
 
           echo "🚀 Running cf deploy..."
           cf deploy mta_archives/demoappjava_1.0.0.mtar -f
           echo "✅ Deployment complete!"
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}
 
   SnapshotDeploy:
+    environment: dev
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.workflow_choice == 'Snapshot Deploy' }}
 
@@ -195,6 +207,11 @@ jobs:
 
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
+          set +x
+          echo "::add-mask::$CF_API"
+          echo "::add-mask::$CF_USER"
+          echo "::add-mask::$CF_PASSWORD"
+          echo "::add-mask::$CF_ORG"
           echo "🔄 Preparing to deploy..."
           echo "Current Branch: 📂"
           git branch
@@ -231,9 +248,14 @@ jobs:
           cf install-plugin multiapps -f
 
           echo "🔑 Logging into Cloud Foundry..."
-          cf login -a ${{ secrets.CF_API }} -u ${{ secrets.CF_USER }} -p ${{ secrets.CF_PASSWORD }} -o ${{ secrets.CF_ORG }} -s ${{ github.event.inputs.cf_space }}
+          cf login -a "$CF_API" -u "$CF_USER" -p "$CF_PASSWORD" -o "$CF_ORG" -s ${{ github.event.inputs.cf_space }} > /dev/null
           echo "✅ Logged in successfully!"
 
           echo "🚀 Running cf deploy..."
           cf deploy mta_archives/demoappjava_1.0.0.mtar -f
           echo "✅ Deployment complete!"
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}

.github/workflows/codeql.yml

@@ -13,6 +13,7 @@ on:
 jobs:
   analyze:
     name: Analyze
+    environment: dev
     runs-on: ubuntu-latest
 
     permissions:

.github/workflows/demo-build.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   build:
+    environment: dev
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/internalArticatory.yml

@@ -87,11 +87,17 @@ jobs:
 
       - name: Verify artifact in Artifactory
         if: ${{ endsWith(steps.bump-version.outputs.updated_version || steps.read-revision.outputs.updated_version, '-SNAPSHOT') }}
+        env:
+          CAP_DEPLOYMENT_USER: ${{ secrets.CAP_DEPLOYMENT_USER }}
+          CAP_DEPLOYMENT_PASS: ${{ secrets.CAP_DEPLOYMENT_PASS }}
         run: |
+          set +x
+          echo "::add-mask::$CAP_DEPLOYMENT_USER"
+          echo "::add-mask::$CAP_DEPLOYMENT_PASS"
           group_path="com/sap/cds/sdm"
           version="${{ steps.bump-version.outputs.updated_version || steps.read-revision.outputs.updated_version }}"
           echo "Checking metadata for $version"
-          curl -u "${{ secrets.CAP_DEPLOYMENT_USER }}:${{ secrets.CAP_DEPLOYMENT_PASS }}" -f -I \
+          curl -u "$CAP_DEPLOYMENT_USER:$CAP_DEPLOYMENT_PASS" -f -I \
             "$ARTIFACTORY_URL/$group_path/$version/maven-metadata.xml" || { echo "Metadata not found"; exit 1; }
           echo "Artifact metadata accessible for $version"
       - name: Summary

.github/workflows/main-build-and-deploy.yml

@@ -13,6 +13,7 @@ on:
 jobs:
 
   update-version:
+    environment: dev
     runs-on: ubuntu-latest
     #needs: blackduck
     steps:
@@ -36,6 +37,7 @@ jobs:
           retention-days: 1
 
   build:
+    environment: dev
     runs-on: ubuntu-latest
     needs: update-version
     steps:
@@ -60,6 +62,7 @@ jobs:
 
   deploy:
     name: Deploy to Artifactory
+    environment: dev
     runs-on: ubuntu-latest
     needs: build
     steps:

.github/workflows/main-build.yml

@@ -12,6 +12,7 @@ on:
 jobs:
   build:
     name: Build
+    environment: dev
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -30,6 +31,7 @@ jobs:
 
   update-version:
     name: Update version
+    environment: dev
     runs-on: ubuntu-latest
     needs: [ build ]
     permissions:

.github/workflows/multi tenancy_Integration.yml

@@ -17,6 +17,7 @@ on:
 jobs:
   # Parallel integration tests using matrix strategy
   integration-test:
+    environment: dev
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -65,23 +66,37 @@ jobs:
 
       - name: Determine Cloud Foundry Space 🌌
         id: determine_space
+        env:
+          CF_SPACE: ${{ secrets.CF_SPACE }}
         run: |
           if [ "${{ github.event.inputs.cf_space }}" == "developcap" ]; then
-            space="${{ secrets.CF_SPACE }}"
+            space="$CF_SPACE"
           else
             space="${{ github.event.inputs.cf_space }}"
           fi
           echo "🌍 Space determined: $space"
           echo "space=$space" >> $GITHUB_OUTPUT
 
       - name: Login to Cloud Foundry 🔑
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}
+          CF_SPACE: ${{ secrets.CF_SPACE }}
         run: |
+          set +x
+          echo "::add-mask::$CF_API"
+          echo "::add-mask::$CF_USER"
+          echo "::add-mask::$CF_PASSWORD"
+          echo "::add-mask::$CF_ORG"
+          echo "::add-mask::$CF_SPACE"
           echo "🔄 Logging in to Cloud Foundry using space: ${{ steps.determine_space.outputs.space }}"
-          cf login -a ${{ secrets.CF_API }} \
-            -u ${{ secrets.CF_USER }} \
-            -p ${{ secrets.CF_PASSWORD }} \
-            -o ${{ secrets.CF_ORG }} \
-            -s ${{ steps.determine_space.outputs.space }}
+          cf login -a "$CF_API" \
+            -u "$CF_USER" \
+            -p "$CF_PASSWORD" \
+            -o "$CF_ORG" \
+            -s ${{ steps.determine_space.outputs.space }} > /dev/null
 
       - name: Fetch and Escape Client Details for single tenant 🔍
         id: fetch_credentials
@@ -157,23 +172,32 @@ jobs:
           CLIENT_ID: ${{ steps.fetch_credentials.outputs.CLIENT_ID }}
           CLIENT_SECRET_MT: ${{ steps.fetch_credentials_mt.outputs.CLIENT_SECRET_MT }}
           CLIENT_ID_MT: ${{ steps.fetch_credentials_mt.outputs.CLIENT_ID_MT }}
+          CF_ORG: ${{ secrets.CF_ORG }}
+          CAPAUTH_URL: ${{ secrets.CAPAUTH_URL }}
+          AUTHURLMT1: ${{ secrets.AUTHURLMT1 }}
+          AUTHURLMT2: ${{ secrets.AUTHURLMT2 }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          NOSDMROLEUSERNAME: ${{ secrets.NOSDMROLEUSERNAME }}
+          NOSDMROLEUSERPASSWORD: ${{ secrets.NOSDMROLEUSERPASSWORD }}
         run: |
           echo "🚀 Preparing credentials for ${{ matrix.tokenFlow }} - ${{ matrix.tenant }}..."
+          set +x
           set -e
           PROPERTIES_FILE="sdm/src/test/resources/credentials.properties"
-          appUrl="${{ secrets.CF_ORG }}-${{ steps.determine_space.outputs.space }}-demoappjava-srv.cfapps.eu12.hana.ondemand.com"
-          appUrlMT="${{ secrets.CF_ORG }}-${{ steps.determine_space.outputs.space }}-bookshop-mt-srv.cfapps.eu12.hana.ondemand.com"
-          authUrl="${{ secrets.CAPAUTH_URL }}"
-          authUrlMT1="${{ secrets.AUTHURLMT1 }}"
-          authUrlMT2="${{ secrets.AUTHURLMT2 }}"
-          clientID="${{ env.CLIENT_ID }}"
-          clientSecret="${{ env.CLIENT_SECRET }}"
-          clientIDMT="${{ env.CLIENT_ID_MT }}"
-          clientSecretMT="${{ env.CLIENT_SECRET_MT }}"
-          username="${{ secrets.CF_USER }}"
-          password="${{ secrets.CF_PASSWORD }}"
-          noSDMRoleUsername="${{ secrets.NOSDMROLEUSERNAME }}"
-          noSDMRoleUserPassword="${{ secrets.NOSDMROLEUSERPASSWORD }}"
+          appUrl="$CF_ORG-${{ steps.determine_space.outputs.space }}-demoappjava-srv.cfapps.eu12.hana.ondemand.com"
+          appUrlMT="$CF_ORG-${{ steps.determine_space.outputs.space }}-bookshop-mt-srv.cfapps.eu12.hana.ondemand.com"
+          authUrl="$CAPAUTH_URL"
+          authUrlMT1="$AUTHURLMT1"
+          authUrlMT2="$AUTHURLMT2"
+          clientID="$CLIENT_ID"
+          clientSecret="$CLIENT_SECRET"
+          clientIDMT="$CLIENT_ID_MT"
+          clientSecretMT="$CLIENT_SECRET_MT"
+          username="$CF_USER"
+          password="$CF_PASSWORD"
+          noSDMRoleUsername="$NOSDMROLEUSERNAME"
+          noSDMRoleUserPassword="$NOSDMROLEUSERPASSWORD"
 
           echo "::add-mask::$clientSecret"
           echo "::add-mask::$clientID"
@@ -218,8 +242,26 @@ jobs:
       - name: Run integration tests (${{ matrix.testClass }} - ${{ matrix.tokenFlow }} - ${{ matrix.tenant }}) 🎯
         run: |
           echo "🎯 Running Maven integration tests: testClass=${{ matrix.testClass }}, tokenFlow=${{ matrix.tokenFlow }}, tenant=${{ matrix.tenant }}"
-          mvn clean verify -P integration-tests -DtokenFlow=${{ matrix.tokenFlow }} -DtenancyModel=multi -Dtenant=${{ matrix.tenant }} -DskipUnitTests -Dfailsafe.includes="**/${{ matrix.testClass }}.java"
-          echo "✅ Integration tests completed for ${{ matrix.testClass }} - ${{ matrix.tokenFlow }} - ${{ matrix.tenant }}!"
+          MAX_RETRIES=3
+          ATTEMPT=0
+          EXIT_CODE=1
+          while [ $ATTEMPT -lt $MAX_RETRIES ]; do
+            ATTEMPT=$((ATTEMPT + 1))
+            echo "🔄 Attempt $ATTEMPT of $MAX_RETRIES..."
+            if mvn clean verify -P integration-tests -DtokenFlow=${{ matrix.tokenFlow }} -DtenancyModel=multi -Dtenant=${{ matrix.tenant }} -DskipUnitTests -Dfailsafe.includes="**/${{ matrix.testClass }}.java"; then
+              echo "✅ Tests passed on attempt $ATTEMPT!"
+              EXIT_CODE=0
+              break
+            else
+              if [ $ATTEMPT -lt $MAX_RETRIES ]; then
+                echo "⚠️ Attempt $ATTEMPT failed. Retrying in 30 seconds..."
+                sleep 30
+              else
+                echo "❌ All $MAX_RETRIES attempts failed for ${{ matrix.testClass }} - ${{ matrix.tokenFlow }} - ${{ matrix.tenant }}."
+              fi
+            fi
+          done
+          exit $EXIT_CODE
 
       - name: Upload test results 📊
         if: always()
@@ -233,6 +275,7 @@ jobs:
 
   # Summary job to aggregate results
   test-summary:
+    environment: dev
     runs-on: ubuntu-latest
     needs: integration-test
     if: always()

.github/workflows/multiTenancyDeployLocal.yml

@@ -24,6 +24,7 @@ permissions:
 
 jobs:
   deploy:
+    environment: dev
     runs-on: ubuntu-latest
 
     steps:
@@ -84,7 +85,7 @@ jobs:
       - name: Set REPOSITORY_ID 🔍
         id: set_repository_id
         run: |
-          echo "repository_id=${{ secrets.REPOSITORY_ID }}" >> $GITHUB_OUTPUT
+          echo "repository_id=${{ secrets.MULTITENANT_REPOSITORY_ID }}" >> $GITHUB_OUTPUT
 
       - name: Run mbt build 🔨
         working-directory: app/multi-tenant/personal-space/cloud-cap-samples-java
@@ -98,7 +99,12 @@ jobs:
 
       - name: Deploy to Cloud Foundry ☁️
         working-directory: app/multi-tenant/personal-space/cloud-cap-samples-java
-        run: | 
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}
+        run: |
             echo "🚀 Deploying to -s ${{ steps.determine_space.outputs.space }}..."
             echo "🔧 Installing Cloud Foundry CLI and plugins..."
 
@@ -107,13 +113,18 @@ jobs:
             echo "deb https://packages.cloudfoundry.org/debian stable main" | sudo tee /etc/apt/sources.list.d/cloudfoundry-cli.list
             sudo apt update
             sudo apt install cf8-cli
-            
+
             cf install-plugin multiapps -f
             echo "✅ Cloud Foundry CLI setup complete!"
 
             # Login to Cloud Foundry again to ensure session is active
             echo "🔑 Logging in to Cloud Foundry..."
-            cf login -a ${{ secrets.CF_API }} -u ${{ secrets.CF_USER }} -p ${{ secrets.CF_PASSWORD }} -o ${{ secrets.CF_ORG }} -s ${{ github.event.inputs.cf_space }}
+            set +x
+            echo "::add-mask::$CF_API"
+            echo "::add-mask::$CF_USER"
+            echo "::add-mask::$CF_PASSWORD"
+            echo "::add-mask::$CF_ORG"
+            cf login -a "$CF_API" -u "$CF_USER" -p "$CF_PASSWORD" -o "$CF_ORG" -s ${{ github.event.inputs.cf_space }} > /dev/null
             echo "✅ Logged in successfully!"
 
             # Deploy the application